Cross-site Scripting (XSS)

Zenario is vulnerable to Cross-site Scripting XSS. The vulnerability is due to allowing authenticated admin users to upload PDF files containing malicious code, which can execute when the PDF is accessed through the website...

CVE-2024-9372

The WP Blocks Hub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, ...

CVE-2024-9368

The Aggregator Advanced Settings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

CVE-2024-9368

CVE-2024-9368 : The WordPress plugin Aggregator Advanced Settings is vulnerable to a Stored Cross-Site Scripting (XSS) via the SVG file upload feature in all versions up to 1.2.1. The root cause is insufficient input sanitization and output escaping for SVG uploads. Exploitation requires authenti...

PT-2024-39529 · WordPress · Re:Wp

Name of the Vulnerable Software and Affected Versions: Re:WP plugin for WordPress version 1.0.1 and earlier Description: The Re:WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This makes it...

PT-2024-32714 · Unknown · Shilpi Client Dashboard

Name of the Vulnerable Software and Affected Versions: Shilpi Client Dashboard affected versions not specified Description: The issue exists due to improper validation of files being uploaded other than the specified extension. An authenticated remote attacker could exploit this by uploading a...

WordPress plugin Aggregator Advanced Settings 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2024-39405 · WordPress · The Easy Demo Importer

Name of the Vulnerable Software and Affected Versions: The Easy Demo Importer – A Modern One-Click Demo Import Solution plugin for WordPress versions up to, and including, 1.1.2 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input...

Vehicle Service Management System 1.0 Code Injection

============================================================================================================================================= | Title : Vehicle Service Management System 1.0 php code injection Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozill...

PT-2024-27797 · Unknown · Itsourcode Online Discussion Forum Project

Name of the Vulnerable Software and Affected Versions: Itsourcecode Online Discussion Forum Project version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via the "poster.php" file. The uploaded file is received using the $ FILES variable. This enables the attacker ...

PT-2024-39644 · WordPress · Wp Cleanup/Basic Functions

Name of the Vulnerable Software and Affected Versions: WP Cleanup and Basic Functions plugin for WordPress versions up to, and including, 2.2.1 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This...

PT-2024-39598 · WordPress · Aggregator Advanced Settings

Name of the Vulnerable Software and Affected Versions: Aggregator Advanced Settings plugin for WordPress versions up to, and including, 1.2.1 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allo...

PT-2024-39600 · WordPress · Wp Blocks Hub

Name of the Vulnerable Software and Affected Versions: WP Blocks Hub plugin for WordPress versions up to, and including, 1.0.2 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticate...

CVE-2024-8967

The PWA — easy way to Progressive Web App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-8967

The PWA — easy way to Progressive Web App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-9172

The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-9172

The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and...

CVE-2024-8967

The CVE refers to the WordPress plugin “PWA — easy way to Progressive Web App” (iworks-pwa) with Stored Cross-Site Scripting via SVG file uploads in versions up to 1.6.3. Root cause: insufficient input sanitization and output escaping for uploaded SVGs, enabling authenticated attackers (Author le...

CVE-2024-7855

The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the updatereview function in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload...

CVE-2024-7855

The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the updatereview function in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload...